tele9752wikiaorg-20200213-history
XxJ4
Background: Know: Prerequisites - source routing Recognize: Prerequisites - loose source routing, spoofing, TCP 3-way handshake Anticipates: Fault management - troubleshooting Source routing The user with source routing can specify part or all routers that the data he/she sends has to go through. Source routing is a strategy based on source address to select the routers. It can send packets to different destination address according to different subnet address. Source routing can be divided into strict source routing and loose source routing. Strict source routing allows a manager to specify the path through all the routers to destination and returns responses through the same path in reverse. Loose source routing allows a manager to specify an address that the packet must pass through on its way to the destination. How it works When the packet with source routing specified is going through the network, the network device that makes routing decisions such as a router will look at the path specific information in the network packet to determine where to forward the packet. When source routing is not used, the packet contains only the destination address and the router will automatically determine the best place to forward the packet. When network routing is used, as a packet travels through the network, each router will look at the destination IP address and determine the next hop to forward the packet to. The next hop is the next router or network switching location where a network routing decision will be made. When source routing is used, the sender of the data makes some or all of the routing decisions. Function Today, source routing is an IP option used mainly by network managers to check the connectivity of the network. Normally, when an IP packet leaves a system, its path is controlled by the routers and their current configuration. Source routing provides a means to override the control of the routers. Source address spoofing It is loose source routing that aids an attacker. With source routing: Relay to fake source address passes attacker who can continue exchange. Without source routing: Reply goes to faked address, so attacker can’t continue exchange. A remote attacker might seek to access a UNIX system protected with TCP wrappers. If the attacker simply spoofs one of the permitted source addresses, the attacker may never get a response. However, if the attacker both spoofs an address and sets the loose-source-routing option to force the response to return to the attacker's network, the attack can succeed. Case study In a normal behavior, host A wants to send a packet to host B. Host A first send it Router 1, and Router 1 looks up the table, and send it to Router 2. Again, R2 sends it to R3, then R6. Therefore, host B receives the packet from host A, which the route is Host A-R1-R2-R3-R6-Host B. With source routing, Host A can identify the packet pass through Host A-R1-R2-R4-R5-R6-Host B, instead of previous route. There are two options when it comes to source routing, Loose source routing Host A-R2-R5-Host B Strict source routing Host A-R1-R4-R5-R6-Host B Hacker malicious use Host B only allows Host A to access the resource, but when hackers use source routing, Host A-Hacker-Host B, See also Wikipedia article on source routing Category:All